Skip to main content

Linux Kernel CVE-2026-74496

| EUVDEUVD-2026-59689 HIGH
2026-08-15 Linux GHSA-p6w2-3hc3-fx3j
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition timing dependency warrants AC:H over vendor AC:L; PR:L reflects CAP_NET_ADMIN or network namespace privilege required.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Aug 17, 2026 - 11:52 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fou: Fix use-after-free in fou_create()

fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou while it is still reachable through sk_user_data. A concurrent receive can then dereference the freed object in fou_from_sock().

This ordering issue was previously noted in the linked discussion.

The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but fou_cfg_cmp() compares the requested port 0 and reports -EALREADY once an entry already exists.

Release the tunnel socket before freeing fou so sk_user_data is cleared first, and defer reclamation with kfree_rcu() to protect concurrent RCU readers. This matches the lifetime handling in fou_release().

AnalysisAI

Use-after-free in the Linux kernel's FOU (Foo-over-UDP) tunnel subsystem allows a local attacker with low privileges to corrupt kernel memory by exploiting a race condition in fou_create(). The struct fou object is published via sk_user_data before being committed to the per-network-namespace port list; when fou_add_to_port_list() subsequently fails on port-0 requests, the error path frees the object while concurrent RCU readers can still dereference it through fou_from_sock(). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain local low-privilege shell
Delivery
Verify FOU module loaded in namespace
Exploit
Request FOU port 0 on populated namespace
Execution
Race concurrent UDP receive event
Persist
Dereference freed struct fou pointer
Impact
Corrupt kernel memory for root access
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local shell access to a Linux host with the FOU kernel module loaded or loadable by the attacker, plus the ability to create FOU sockets - which typically requires CAP_NET_ADMIN or its equivalent within the relevant network namespace. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The official CVSS score of 7.8 (AV:L/AC:L/PR:L) positions this as a high-severity local privilege escalation, but several signals moderate the urgency for most operators. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local attacker with low-privilege access to a Linux host where the FOU module is loaded creates a FOU socket requesting port 0 at a moment when at least one FOU entry already exists in the network namespace, causing fou_add_to_port_list() to return -EALREADY. The error path frees struct fou without clearing sk_user_data, and a concurrently arriving UDP packet causes the kernel to dereference the freed pointer in fou_from_sock(). …
Remediation Apply the two stable-branch upstream fixes: https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107 and https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, scan infrastructure to identify Linux systems and their kernel versions to determine exposure to CVE-2026-74496. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74496 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy